Add approved character production packages to Universe

[atomantic]

Part of #5377.

Goal

Extend Universe characters into approved, versioned production packages that can drive consistent visual identity and voice without putting local model artifacts or private recordings into federated records.

Proposed approach

• Add a backward-compatible, bounded voiceCanon object alongside existing speechAccent, speechPattern, and voiceId fields.
• Add UI and schema support for description, default delivery, emotional range, negative direction, pronunciations, version, and source policy.
• Present an approved Identity pack as a curated view over existing managed character assets: neutral, profile, full-body, expression/gesture, wardrobe, prop/scale, and negative-identity references.
• Preserve generated assets as candidates until explicitly approved.
• Keep provider ids, filesystem paths, model revisions, performer identity, and training artifacts out of the portable Universe record.
• Add ready/missing/ambiguous status for required character package roles.

Acceptance criteria

• Existing Universes load and save unchanged when voiceCanon is absent.
• Sanitizers bound every new string, array, enum, numeric value, and asset-role collection.
• The editor can approve and revoke identity-pack assets and a voice-canon revision.
• Canon-locked production refuses or clearly degrades when a required approved role is missing or ambiguous.
• Federated Universe payloads contain portable canon only and no local artifact pointers or private source material.
• Schema, client pick/merge behavior, backup/storage classification, and tests remain in parity.

Out of scope

• Training a visual or voice model.
• Building the hosted runtime.